Created roles are assigned to the service account in the respective project.

If the network, storage, and Service Engine resources are to be created in the same project, assign all the roles to the service account in the same project.

If the network, storage, and Service Engine resources are to be created in different projects, assign resource specific roles to the service account in the resource project.

You can assign roles to the service account either using the GCP command-line tool or the GCP Console.